Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 21:13
Static task
static1
Behavioral task
behavioral1
Sample
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe
Resource
win10v2004-20220722-en
General
-
Target
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe
-
Size
235KB
-
MD5
b01def8d40508f47389660370fb764f5
-
SHA1
985351e28ae47d6f9023f69603cdd6cfb56a6d57
-
SHA256
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a
-
SHA512
836829b73ea5e4f255bfafc4fd3817df83d642690625c909c7d2d525b68be19c8f878c8befa972120395f2fdc2450238a28dfbc37dd442e7d21c5d667047bc58
Malware Config
Signatures
-
GandCrab payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-55-0x0000000000400000-0x0000000002588000-memory.dmp family_gandcrab behavioral1/memory/2024-59-0x0000000000400000-0x0000000002588000-memory.dmp family_gandcrab behavioral1/memory/2024-60-0x00000000003C0000-0x00000000003D6000-memory.dmp family_gandcrab behavioral1/memory/2024-67-0x00000000003C0000-0x00000000003D6000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wrqmnahfsiw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe" 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exedescription ioc process File opened (read-only) \??\L: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\O: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\Q: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\V: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\W: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\X: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\G: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\J: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\T: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\K: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\N: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\U: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\I: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\M: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\E: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\F: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\H: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\P: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\R: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\S: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\A: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\B: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\Y: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe File opened (read-only) \??\Z: 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exepid process 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exedescription pid process target process PID 2024 wrote to memory of 1660 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1660 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1660 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1660 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1768 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1768 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1768 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1768 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 672 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 672 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 672 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 672 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1056 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1056 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1056 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1056 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1924 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1924 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1924 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1924 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 772 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 772 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 772 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 772 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 324 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 324 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 324 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 324 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1452 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1452 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1452 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1452 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1912 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1912 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1912 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1912 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1400 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1400 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1400 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1400 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 888 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 888 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 888 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 888 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1000 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1000 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1000 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1000 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1584 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1584 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1584 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1584 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 896 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 896 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 896 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 896 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1364 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1364 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1364 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 1364 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 588 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 588 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 588 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe PID 2024 wrote to memory of 588 2024 5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe"C:\Users\Admin\AppData\Local\Temp\5e296ad95844f259faed968ac78ed066254a9d3b6e511a6cee61278cacfbf12a.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/324-69-0x0000000000000000-mapping.dmp
-
memory/336-106-0x0000000000000000-mapping.dmp
-
memory/548-90-0x0000000000000000-mapping.dmp
-
memory/564-98-0x0000000000000000-mapping.dmp
-
memory/588-78-0x0000000000000000-mapping.dmp
-
memory/604-100-0x0000000000000000-mapping.dmp
-
memory/672-63-0x0000000000000000-mapping.dmp
-
memory/684-102-0x0000000000000000-mapping.dmp
-
memory/704-83-0x0000000000000000-mapping.dmp
-
memory/756-94-0x0000000000000000-mapping.dmp
-
memory/772-68-0x0000000000000000-mapping.dmp
-
memory/800-95-0x0000000000000000-mapping.dmp
-
memory/804-109-0x0000000000000000-mapping.dmp
-
memory/828-97-0x0000000000000000-mapping.dmp
-
memory/888-73-0x0000000000000000-mapping.dmp
-
memory/892-92-0x0000000000000000-mapping.dmp
-
memory/896-76-0x0000000000000000-mapping.dmp
-
memory/980-99-0x0000000000000000-mapping.dmp
-
memory/988-113-0x0000000000000000-mapping.dmp
-
memory/1000-74-0x0000000000000000-mapping.dmp
-
memory/1056-64-0x0000000000000000-mapping.dmp
-
memory/1072-84-0x0000000000000000-mapping.dmp
-
memory/1164-107-0x0000000000000000-mapping.dmp
-
memory/1172-114-0x0000000000000000-mapping.dmp
-
memory/1188-93-0x0000000000000000-mapping.dmp
-
memory/1208-91-0x0000000000000000-mapping.dmp
-
memory/1264-96-0x0000000000000000-mapping.dmp
-
memory/1364-77-0x0000000000000000-mapping.dmp
-
memory/1400-72-0x0000000000000000-mapping.dmp
-
memory/1452-70-0x0000000000000000-mapping.dmp
-
memory/1472-85-0x0000000000000000-mapping.dmp
-
memory/1476-103-0x0000000000000000-mapping.dmp
-
memory/1512-79-0x0000000000000000-mapping.dmp
-
memory/1552-82-0x0000000000000000-mapping.dmp
-
memory/1568-108-0x0000000000000000-mapping.dmp
-
memory/1572-104-0x0000000000000000-mapping.dmp
-
memory/1580-89-0x0000000000000000-mapping.dmp
-
memory/1584-75-0x0000000000000000-mapping.dmp
-
memory/1616-80-0x0000000000000000-mapping.dmp
-
memory/1660-61-0x0000000000000000-mapping.dmp
-
memory/1676-111-0x0000000000000000-mapping.dmp
-
memory/1712-105-0x0000000000000000-mapping.dmp
-
memory/1724-110-0x0000000000000000-mapping.dmp
-
memory/1728-86-0x0000000000000000-mapping.dmp
-
memory/1752-88-0x0000000000000000-mapping.dmp
-
memory/1756-81-0x0000000000000000-mapping.dmp
-
memory/1768-62-0x0000000000000000-mapping.dmp
-
memory/1792-87-0x0000000000000000-mapping.dmp
-
memory/1872-112-0x0000000000000000-mapping.dmp
-
memory/1912-71-0x0000000000000000-mapping.dmp
-
memory/1924-66-0x0000000000000000-mapping.dmp
-
memory/2024-60-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/2024-59-0x0000000000400000-0x0000000002588000-memory.dmpFilesize
33.5MB
-
memory/2024-58-0x0000000000240000-0x0000000000340000-memory.dmpFilesize
1024KB
-
memory/2024-65-0x0000000000240000-0x0000000000340000-memory.dmpFilesize
1024KB
-
memory/2024-55-0x0000000000400000-0x0000000002588000-memory.dmpFilesize
33.5MB
-
memory/2024-56-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/2024-67-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/2040-101-0x0000000000000000-mapping.dmp